Find what you’re looking for
Browse everything
6,877 results in Threat Reports
UAT-8099's Exploitation of IIS Servers in Asia Using BadIIS Malware
Between late 2025 and early 2026, the China-linked threat actor UAT-8099 launched a campaign targeting vulnerable Internet Information Services (IIS) servers across Asia, with a particular focus on Thailand and Vietnam. The attackers exploited security vulnerabilities to gain initial access, deploying web shells and leveraging tools like GotoHTTP for remote control. They installed customized variants of the BadIIS malware to manipulate search engine optimization (SEO) rankings, redirecting users to malicious sites and exfiltrating sensitive data. This operation underscores the evolving tactics of cybercriminals in exploiting web server vulnerabilities for financial gain and data theft. Organizations are urged to strengthen their server defenses and monitor for signs of such sophisticated intrusions. ([thehackernews.com](https://thehackernews.com/2026/01/china-linked-uat-8099-targets-iis.html?utm_source=openai))
Malicious Chrome Extensions Compromise User Security by Hijacking Affiliate Links and Stealing ChatGPT Tokens
In January 2026, cybersecurity researchers uncovered a series of malicious Google Chrome extensions designed to hijack affiliate links and steal OpenAI ChatGPT authentication tokens. Notably, the 'Amazon Ads Blocker' extension, uploaded by '10Xprofit' on January 19, 2026, claimed to block Amazon ads but covertly injected the developer's affiliate tag into product links, replacing existing ones. This extension was part of a larger cluster targeting e-commerce platforms like AliExpress, Amazon, Best Buy, Shein, Shopify, and Walmart. Additionally, 16 other extensions masquerading as ChatGPT productivity tools were found to exfiltrate ChatGPT session tokens, granting attackers full access to users' conversation histories and associated data. This incident underscores the growing trend of malicious browser extensions exploiting the popularity of AI tools and e-commerce platforms. The deceptive nature of these extensions, often appearing legitimate and even bearing 'Featured' badges, highlights the need for heightened vigilance among users and stricter vetting processes by browser extension stores to prevent such security breaches.
OpenClaw AI's Security Challenges in 2026: A Wake-Up Call for AI Deployment
In January 2026, the open-source AI assistant OpenClaw (formerly known as Clawdbot and Moltbot) faced significant security vulnerabilities due to its deep system access and widespread misconfigurations. Users inadvertently exposed control panels and API keys, leading to unauthorized access and potential data breaches. Additionally, the platform's susceptibility to prompt injection attacks allowed malicious actors to manipulate the AI into executing unintended commands, posing severe risks to user data and system integrity. ([axios.com](https://www.axios.com/2026/01/29/moltbot-cybersecurity-ai-agent-risks?utm_source=openai)) The incident underscores the critical need for robust security measures in AI deployments, especially as autonomous agents gain popularity. Organizations must prioritize secure configurations, implement strict access controls, and conduct regular security audits to mitigate risks associated with AI assistants like OpenClaw.
Critical Unauthenticated RCE Vulnerability in n8n (CVE-2026-21858)
In early January 2026, a critical vulnerability, CVE-2026-21858, was discovered in n8n, an open-source workflow automation platform. This flaw, dubbed 'Ni8mare,' allows unauthenticated remote code execution due to improper input validation in form-based workflows. Exploiting this vulnerability enables attackers to gain full control over affected servers, leading to potential data theft, workflow manipulation, and system compromise. ([purple-ops.io](https://www.purple-ops.io/resources-hottest-cves/cve-2026-21858-ai-exploit/?utm_source=openai)) The widespread use of n8n, with over 100 million Docker pulls and numerous internet-exposed instances, amplifies the risk. As of January 11, 2026, approximately 59,500 vulnerable hosts remain exposed, highlighting the urgency for organizations to apply the available patches promptly. ([techradar.com](https://www.techradar.com/pro/security/thousands-of-n8n-instances-under-threat-from-top-security-issue?utm_source=openai))
Chinese APTs Target ASEAN Entities with Advanced Malware
In early 2024, Chinese state-sponsored Advanced Persistent Threat (APT) groups, notably Stately Taurus (also known as Mustang Panda), launched sophisticated cyber-espionage campaigns targeting entities across ASEAN countries, including Myanmar, the Philippines, Japan, and Singapore. These operations coincided with the ASEAN-Australia Special Summit in March 2024, suggesting a strategic intent to gather intelligence during significant diplomatic events. The attackers employed advanced malware packages, such as PUBLOAD downloader, delivered through phishing emails containing malicious ZIP archives and screensaver executables. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/chinese-apts-target-asean-entities/?utm_source=openai)) This incident underscores the escalating cyber threats posed by state-sponsored actors in the Asia-Pacific region. The use of sophisticated malware and targeted phishing campaigns highlights the need for heightened cybersecurity measures, especially during high-profile events that may attract espionage activities.
Salt Typhoon's 2024 Breach of U.S. Telecom Networks: A Wake-Up Call for Cybersecurity
In 2024, the Chinese state-sponsored hacking group known as Salt Typhoon orchestrated a sophisticated cyber espionage campaign targeting major U.S. telecommunications companies, including AT&T, Verizon, and T-Mobile. By exploiting vulnerabilities in network devices and systems, the group gained unauthorized access to sensitive data such as call logs, text messages, and, in some instances, audio recordings. Notably, they infiltrated systems used for lawful wiretapping, posing significant national security concerns. The attackers employed advanced techniques, including 'living off the land' tactics, utilizing legitimate administrative tools to evade detection and maintain persistent access. This incident underscores the escalating threat posed by state-sponsored cyber actors to critical infrastructure. The breach highlights the necessity for robust cybersecurity measures and continuous monitoring to detect and mitigate such sophisticated intrusions. Organizations must prioritize the security of their network devices and systems to prevent similar attacks in the future.
Safeguarding AI Assets: Lessons from the 2025 Model Extraction Attack
In 2025, a significant AI model extraction attack was identified, where adversaries systematically queried a proprietary machine learning model's API to replicate its functionality. By sending carefully crafted inputs and analyzing the outputs, attackers reconstructed a substitute model that closely mirrored the original's behavior. This breach exposed the model's intellectual property, leading to potential competitive disadvantages and financial losses for the organization. The incident underscores the vulnerabilities inherent in exposing AI models through APIs without adequate security measures. ([techtarget.com](https://www.techtarget.com/searchsecurity/tip/AI-model-theft-Risk-and-mitigation-in-the-digital-era?utm_source=openai)) The rise of such model extraction attacks highlights the urgent need for organizations to implement robust defenses, including rate limiting, output perturbation, and behavioral monitoring, to protect their AI assets from unauthorized replication and misuse. ([snyk.io](https://snyk.io/articles/ai-model-theft/?utm_source=openai))
Swarmer Tool: Exploiting Windows Legacy Features for Stealthy Registry Persistence
In February 2025, Praetorian Inc. introduced 'Swarmer,' a tool designed to achieve stealthy Windows registry persistence without triggering Endpoint Detection and Response (EDR) systems. By exploiting legacy Windows features such as mandatory user profiles and the Offline Registry API, Swarmer allows low-privilege users to modify the NTUSER hive covertly. This method bypasses standard registry APIs monitored by EDR solutions, enabling attackers to establish persistence without detection. The release of Swarmer underscores the ongoing challenges in cybersecurity, particularly the exploitation of overlooked system functionalities. As attackers continue to innovate, it is imperative for organizations to reassess and fortify their security postures against such sophisticated techniques.
Oracle WebLogic Server Proxy Plugin Vulnerability (CVE-2026-21962): What You Need to Know
In January 2026, Oracle disclosed a critical vulnerability (CVE-2026-21962) affecting Oracle HTTP Server and WebLogic Server Proxy Plug-ins for both Apache HTTP Server and Microsoft IIS. This flaw allows unauthenticated remote attackers to bypass security controls, potentially gaining unauthorized access to backend WebLogic systems. Given that these proxy plugins often reside in DMZ environments, the exposure is significant. The vulnerability has a CVSS 3.1 Base Score of 10.0, indicating its high severity due to low attack complexity and the potential for substantial compromise. ([netspi.com](https://www.netspi.com/blog/executive-blog/vulnerability-management/oracle-weblogic-server-proxy-plugin-cve-2026-21962-overview-takeaways/?utm_source=openai)) The current relevance of this incident is underscored by the ease of exploitation and the critical nature of the affected systems. Organizations utilizing the impacted versions are urged to apply Oracle's Critical Patch Update immediately to mitigate the risk of unauthorized data access and potential system compromise. ([netspi.com](https://www.netspi.com/blog/executive-blog/vulnerability-management/oracle-weblogic-server-proxy-plugin-cve-2026-21962-overview-takeaways/?utm_source=openai))
TA584's Escalation: Deploying Tsundere Bot and XWorm in Ransomware Campaigns
In late 2025, the threat actor TA584 significantly escalated its operations, tripling campaign volumes and expanding targets beyond North America and the UK to include Germany, other European countries, and Australia. Utilizing sophisticated phishing emails, TA584 employed the Tsundere Bot malware alongside the XWorm remote access trojan to gain unauthorized network access. These campaigns often began with emails from compromised accounts, leading victims through CAPTCHA and ClickFix pages that prompted the execution of PowerShell commands, resulting in the deployment of malware directly into system memory. Tsundere Bot, a malware-as-a-service platform, functions as both a backdoor and loader, requiring Node.js for operation and retrieving command-and-control addresses from the Ethereum blockchain using the EtherHiding technique. The malware is capable of system profiling, executing arbitrary JavaScript code, and turning infected machines into SOCKS proxies. Given TA584's history and the capabilities of the deployed malware, these infections pose a significant risk of leading to ransomware attacks. The rapid evolution and expansion of TA584's tactics underscore the increasing sophistication of initial access brokers and the persistent threat they pose to organizations worldwide.
Match Group's 2026 Data Breach: A Wake-Up Call for Digital Security
In late January 2026, Match Group, the parent company of popular dating platforms such as Hinge, Match.com, and OkCupid, experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers claimed to have exfiltrated over 10 million user records, including user IDs, transaction details, IP addresses, and internal corporate documents. The breach was reportedly facilitated through a vulnerability in AppsFlyer, a mobile marketing analytics platform utilized by Match Group. Match Group promptly initiated an investigation with external cybersecurity experts and began notifying affected users. Preliminary findings indicated that user login credentials, financial information, and private communications were not accessed. ([cybernews.com](https://cybernews.com/security/hinge-okcupid-data-leak-shinyhunters-claims/?utm_source=openai)) This incident underscores the persistent threat posed by sophisticated cybercriminal organizations like ShinyHunters, known for targeting high-profile companies and leaking sensitive data. The breach highlights the critical importance of securing third-party integrations and the need for robust cybersecurity measures to protect user data. Organizations must remain vigilant and proactive in identifying and mitigating potential vulnerabilities to prevent similar incidents.
How the 2024 Microsoft Office Zero-Day Shaped Urgent Security Responses
In June 2024, Microsoft was compelled to release an emergency patch for a critical zero-day vulnerability affecting Microsoft Office products. The issue allowed attackers to exploit crafted Office documents, enabling remote code execution if a victim opened a malicious file. Attackers leveraged social engineering—including phishing—to trick users into opening infected attachments, bypassing standard email and endpoint defenses. Rapid weaponization of the exploit by criminal groups and likely state-backed actors resulted in significant risk for businesses using vulnerable Office deployments, with potential for data theft, malware infection, and lateral movement across networks. This attack highlights a pervasive trend of adversaries capitalizing on zero-day vulnerabilities in widely used productivity platforms. As seen in recent high-profile breaches, rapid exploitation before patches can be applied increases organizational risk and regulatory scrutiny, necessitating faster detection, patching, and user education across industries.